eDiscovery domain limiting condition

[Frodo_Baggins]

Running a SAR but have a few domains and would like to limit the domains that are searched e.g. only emails sent\received by users with an @Middleearth email address but also includes the words "The One Ring" in the subject\body?

Current search un-restricted is 340GB - Anyone have experience with the KQL editor? Tried the below as keywords (Might have to open in new tab as the image looks really small for some reason...)

 

 

Cheers!

[psydii]

((ParticipantDomains="middleearth") AND (Subject:"The One Ring"))

 

The KQL query builder is our friend.